d5ab54c78f95d027c2ac14879fe9d044b0524a7bcc2a1c59122ee5b67cba379a

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:51

Target

Gccg/Check Installed.bat
Size

35B
MD5

aa26a306d838463eaf138c313dd4f76c
SHA1

1309d5acabd1111dc14f2438b0a433ab3ae5275a
SHA256

863d2335ffab7cad409d61b6b0db5b62083c2c375d40c0b3c0acd42d265bb4b8
SHA512

82fa6c83482ffa43ff6b25b58d9f7498255380bcf215847fc112b31f8592c0ae464fae50c2b3193fc56d349aecea1146861526618e43a9fe03e06e0ddb723595

Score

7^/10

upx

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2376-0-0x00000000002E0000-0x000000000037C000-memory.dmp	upx
behavioral1/memory/2600-2-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/2636-3-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/2744-4-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/2744-5-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/2736-7-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/3064-8-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/3064-9-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2376	perl.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2376	2288	cmd.exe	28
PID 2288 wrote to memory of 2376	2288	cmd.exe	28
PID 2288 wrote to memory of 2376	2288	cmd.exe	28
PID 2288 wrote to memory of 2376	2288	cmd.exe	28
PID 2376 wrote to memory of 2600	2376	perl.exe	29
PID 2376 wrote to memory of 2600	2376	perl.exe	29
PID 2376 wrote to memory of 2600	2376	perl.exe	29
PID 2376 wrote to memory of 2600	2376	perl.exe	29
PID 2376 wrote to memory of 2636	2376	perl.exe	30
PID 2376 wrote to memory of 2636	2376	perl.exe	30
PID 2376 wrote to memory of 2636	2376	perl.exe	30
PID 2376 wrote to memory of 2636	2376	perl.exe	30
PID 2376 wrote to memory of 2744	2376	perl.exe	31
PID 2376 wrote to memory of 2744	2376	perl.exe	31
PID 2376 wrote to memory of 2744	2376	perl.exe	31
PID 2376 wrote to memory of 2744	2376	perl.exe	31
PID 2376 wrote to memory of 2736	2376	perl.exe	32
PID 2376 wrote to memory of 2736	2376	perl.exe	32
PID 2376 wrote to memory of 2736	2376	perl.exe	32
PID 2376 wrote to memory of 2736	2376	perl.exe	32
PID 2376 wrote to memory of 3064	2376	perl.exe	33
PID 2376 wrote to memory of 3064	2376	perl.exe	33
PID 2376 wrote to memory of 3064	2376	perl.exe	33
PID 2376 wrote to memory of 3064	2376	perl.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Gccg\Check Installed.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\Gccg\perl.exe
  perl gccg_package status
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://gccg.sourceforge.net/modules/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.derangedmonkey.com/bmin/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://www.reneploetz.de/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://lotrtcgdb.com/files/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Gccg\wget.exe
    wget -t 0 http://whiterose.net/~wlk/gccg/available.xml
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3064

memory/2376-0-0x00000000002E0000-0x000000000037C000-memory.dmp

Filesize
624KB

Download
memory/2376-1-0x00000000002E0000-0x000000000037C000-memory.dmp

Filesize
624KB

Download
memory/2600-2-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2636-3-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2736-7-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2744-4-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2744-5-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/3064-8-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/3064-9-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download